Check H10 · execution family · severity HIGH · automatic · one of the 18 Hugging Face checks
The question this check asks: does this dataset repository ship a Python file that Hugging Face's own loader will execute the moment someone calls load_dataset("org/name")? Not whether the file looks suspicious — whether calling the ordinary, documented loading function runs code at all.
Hugging Face datasets can ship a loading script — arbitrary Python that runs as part of assembling the dataset the first time it's requested. That is not a bug in the platform; it is a real, sanctioned mechanism for datasets that need genuine work done before they're usable — pulling multiple source files together, converting formats, building custom splits — and it predates the industry's more recent push toward script-free, purely declarative dataset formats. Which is exactly why it's worth flagging: a loading script is not disguised code the way a malicious pickle payload is. It is code, by design, meant to run. The conceptual sibling on the GitHub side of RepoGates is C16 install scripts — a file whose entire purpose is to execute the moment the surrounding tooling does the ordinary thing. A load_dataset() call is a far more casual trigger than a build step, though: one line inside a training script or a notebook cell, no confirmation prompt, nothing to say no to.
H10 reads the dataset repository's file listing — the same single call that returns every filename in the repository, no clone needed — and matches it against the loading-script naming convention. A match fires hf-dataset-script:<path> at HIGH, costing 10 points. The evidence note in the scoring table:
“load_dataset() executes it”
H10 sits in the install and run dimension alongside H6–H9 and H13 — the checks that together answer "what happens when you actually use this artifact the normal way," rather than the more conservative question the clone dimension asks. Verdict math is the same engine used across all 18 checks: any CRITICAL finding zeroes the score and reads BLOCK outright; otherwise the score starts at 100 and each fired finding's points are subtracted, floored at 0, with the grade read off green (PASS, ≥ 80), amber (REVIEW, 50–79) or red (BLOCK, < 50 or any CRIT). A dataset that trips nothing besides H10 lands at 90 — inside the PASS band on its own — which is normal: H10 rarely determines a verdict by itself. It usually rides alongside whatever else the install-and-run dimension turns up, most often H8 (pickle-only weights) or H13 (an incomplete Hub scan) on the same repository.
The 12 September 2026 top-100 measurement (see /intel/malicious-models.html) was run against the 100 most-downloaded models on the Hub, not datasets. H10 only ever fires on dataset repositories, so that cohort cannot tell us this check's real-world false-positive rate, and we don't have a published per-check number for datasets yet — we would rather say that plainly than invent one.
What we can say without a measurement: plenty of legitimate, well-established Hugging Face datasets still ship a loading script, because it was the only way to assemble that dataset when it was published and nobody has had reason to migrate it since. A maintainer doing ordinary, useful work with the mechanism the platform gave them looks identical, from the file tree alone, to one hiding something in it.
H10 does not read the script. It cannot tell an innocuous field remapping from something that shells out or phones home — it is a presence check on the execution surface, not a content-safety verdict, the same limitation C16 carries for GitHub install scripts. It also only applies to dataset repositories: a model repository's equivalent risk — custom code that runs on load — is H9's job, not H10's.
And the absence of a loading script proves nothing either. Most datasets today ship as plain Parquet or Arrow files with no script at all, which says nothing about what's actually inside the data — a clean H10 result is not a claim about the dataset's contents, only about whether Hugging Face's loader will run code to fetch them.
And RepoGates as a whole gates browser downloads only — it does not see git clone, package managers, curl, or fetches made by AI agents outside the browser.
Without installing anything: open the dataset's Files and versions tab on its Hub page and look for a .py file, conventionally named after the dataset itself. With the API:
curl https://huggingface.co/api/datasets/OWNER/NAMEand check the returned file listing for a .py entry. If one is there, open it before trusting load_dataset() to run it unattended — read what it imports, and whether it reaches out to anything beyond the files the dataset itself declares.
Does a dataset loading script mean the dataset is malicious? No. Loading scripts are a long-standing, sanctioned mechanism for datasets that need real assembly work, predating the platform's push toward script-free formats. H10 fires at HIGH because load_dataset() will execute whatever the script contains, not because the script is presumed hostile.
Why does H10 fire on the file tree alone, without reading what the script does? Because presence is the fact that matters for a download-time gate: the moment load_dataset() runs, the script executes. RepoGates flags the execution surface, not a judgement about that particular code.
Does RepoGates stop load_dataset() or pip install from running a flagged script? No. Browser-initiated downloads only.
H9 Custom code on load — the model-repository version of "this executes the moment you use it normally" · H8 Pickle-only weights — another format-level property that determines whether loading executes code · H13 Hub scan incomplete — the dimension sibling that covers what the Hub's own scanners haven't finished looking at · C16 Install scripts — the GitHub-side mirror of the same idea: a file that runs because the ordinary tooling ran it.
Add RepoGates to Chrome Pricing
Numbers on this page: RepoGates' Hugging Face scoring tables (backend/repotriage/hf/catalogue.py, backend/policy/scoring.json); false-positive context from the 12 September 2026 top-100 measurement (/intel/malicious-models.html), which covered models, not dataset repositories.